Terms of Reference 



The Observer and Steve Whittamore 



I have been asked by Alan Rusbridger, Guardian News and Media's Editor-in-Chief, to conduct an 
inquiry into the Observer's use of the private investigator Steve Whittamore between 1999 and 
2003. 

This inquiry is in my capacity as External Ombudsman to the Scott Trust, owners of the Guardian 
and the Observer. The key considerations under the Terms of Reference are:- 

1 . To what extent the information sought via Steve Whittamore was publicly available, or 
available by legitimate lawful means and whether and to what extent the use of Whittamore 
was for expediency. 

2. Whether it is likely that the journalist or editorial staff knew of/should have known that 
obtaining the information potentially involved breaches of editorial codes/civil or criminal 
law. 

3. Whether the obtaining of information must have involved a breach of the relevant laws or 
editorial codes. 

4. Whether in such cases there is evidence that there were public interest reasons for such 
breaches. 

In 2006 Roger Alton, then Editor of the Observer, stated, "Yes, the Observer has used the services 
of an outside agency in the past, and while there has been strong public interest defences for most of 
these cases, it is possible that some of the enquiries did not sufficiently fit that criterion". 1 
Since then the phone hacking scandal and the subsequent Inquiry by Lord Justice Leveson into the 
press, which began on 14 th November 2011, has intensified public debate about privacy issues in 
relation to journalism. 

In this context Roger Alton's answer inevitably produced the response from some commentators, 
particularly the bloggers I have read, that as he did not unequivocally confirm that all enquiries 
were in the public interest then the Observer must therefore, at the very least, have broken the Data 
Protection Act and/or the relevant journalistic codes on privacy. 2 At its heart my job is to establish, 
as best I can, whether this is the case or not. 

Background 

In March 2003 a small team of officials from the Information Commissioner's Office (hereafter the 
ICO) visited a tiny back office in the family home of private investigator Steve Whittamore and his 
wife Georgina at New Milton in Hampshire. 

In the next six hours the five ICO officials uncovered thousands of requests to Whittamore for 
confidential data by journalists from a wide range of newspapers and magazines. In Whittamore's 
office they found four A4 notebooks - coloured red, yellow, green and blue - that detailed over 
13,000 transactions. This was a major breakthrough for the Information Commissioner's 
investigation into a large scale data trade by the press, which was called Operation Motorman 
because it focussed initially on the sale of private information from the Driver and Vehicle 
Licensing Agency (hereafter DVLA). 

The long road to Steve Whittamore's treasure trove of information had in fact begun earlier with a 
two year investigation by Devon and Cornwall police into breaches of privacy. They uncovered a 
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trade in data which included information on ninety three 'victims' including Gordon Brown and 
Labour MP Nick Brown. Operation Reproof, as it was called, ultimately led to six men being 
charged but the case collapsed in court. Judge Paul Darlow concluded that there was no case to 
answer and the evidence was never put in front of a jury. The six defendants were two police 
officers, two former officers and two private investigators. 3 At the Leveson Inquiry, Devon and 
Cornwall Police stated that, 'there was no direct evidence that any media organisation was in any 
way involved in the obtaining of illicit information'. 4 

Nonetheless, Operation Reproof meant that the British press was one step closer to the spotlight. 
One of the men investigated, but not charged, was John Boyall, a private detective running a 
company called Data Research Ltd. It was a raid under warrant by the Operation Reproof team at 
Devon and Cornwall Police, accompanied by the ICO, on Boyall's Surrey premises that connected 
him to another private investigator, Steve Whittamore, and ultimately, to uncovering a data trade 
with Fleet Street on a previously unimagined scale. 5 Opening this 'Pandora's Box',as the ICO called 
it, revealed Whittamore's dealings with 305 journalists on 21 newspapers and 11 magazines. 

As a result, in April 2005 private investigators Steve Whittamore and John Boyall were charged 
with obtaining personal information contrary to the Data Protection Act 1998. 6 Alongside them in 
the dock at Blackfriars Crown Court were retired police officer Alan King and Paul Marshall, a 
civilian police communications officer at Tooting police station in South London, both charged 
with conspiring to commit misconduct in public office. The allegation was that Marshall conducted 
checks on the Police National Computer which he passed onto Alan King. In turn the information 
then was "sold" to Whittamore and Boyall. Targets included Jessie Wallace from EastEnders and 
trade union leader Bob Crow. All four defendants pleaded guilty and were given a conditional 
discharge. DCI Brendan Gilmour, in evidence later to the Leveson Inquiry, stated, 'The sentences in 
this case were a disappointment to the police and CPS and were viewed as being unduly lenient'. 7 At 
the trial Judge Samuels Q.C. was told by Whittamore's lawyer, "Mr Whittamore's means are 
limited, he is a depressed individual. He relies heavily on his mother-in-law and is reclusive now". 8 

In the course of Operation Glade, as this third investigation was called, seven journalists (none from 
the Observer) were interviewed under caution but no further action was taken against them as, 
according to DCI Gilmour, 'insufficient evidence existed at that time to prosecute them'. He also 
said,' All of the journalists accepted that they had used Whittamore to obtain information but denied 
knowing that a corrupt police employee or unlawful methods were used'. 9 

So while both Operation Reproof and Operation Glade centred on misconduct by the police or 
police employees in "public office", Operation Motorman was different. This investigation was led 
by the Information Commissioner not by the police, and was on a wholly different scale. It centred 
on a vast number of potential breaches of the Data Protection Act, involving scores of newspapers 
and magazines. Other organisations such as insurers and credit agencies also paid Whittamore for 
personal data. 

The list of people apparently targeted by newspapers via Steve Whittamore and his associates and 
painstakingly written down in his four notebooks is very long. The Sunday Express used private 
investigators to obtain the private telephone number of the parents of Holly Wells, after she was 
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murdered by Ian Huntley. Express Newspapers later claimed it had "never instructed private 
detectives to obtain information illegally". The People and News of the World used Whittamore to 
obtain private numbers for the family of Stuart Lubbock whose body was found in Michael 
Barrymore's swimming pool. The People used Whittamore to find information about the families of 
children killed in the Dunblane massacre. 10 

Car registration details were passed onto journalists in search of Caprice and Glen Hoddle and 
Whittamore obtained ex-directory details of members of England's World Cup Soccer squad. Other 
victims included Ian Hislop, Lenny Henry, Wayne Rooney's mother, Carol Vorderman's brother, the 
former wife of Poet Laureate Andrew Motion, Kate Middleton, Chelsea Clinton 11 , former England 
footballer Tony Adams, Joanna Lumley and Harold Shipman's daughter. 12 These are just a few of 
the thousands of names on the celebrity circuit recorded in Steve Whittamore's coloured notebooks. 

One target, Charlotte Church, told ITV News that the Whittamore operation had sought information 
on "anyone I have ever known", from teenage friends to people who knew her parents, to her 
grandmother. 13 

In addition, there were people, as Lord Justice Leveson put it, 'of no obvious newsworthiness who 
had simply strayed by chance into the limelight. 14 These included a greengrocer, a painter and 
decorator, a hearing aid technician and a doctor. 

Data Protection and Privacy 

Under the Data Protection Act 1998 Section 55 (1) (hereafter DPA) it is an offence to "knowingly or 
recklessly obtain or disclose personal data or procure the disclosure to another of personal data". 
However an offence will not have been committed under the Data Protection Act" if the disclosing 
or procuring was necessary for the purpose of preventing or detecting crime" or that "he acted in the 
reasonable belief that he had in law the right to obtain or disclose the data information". 

There is also a defence under the DPA for a person who can justify that "the obtaining, disclosing or 
procuring was justified as being in the public interest". In addition, under the DPA journalists are 
exempt from most types of civil liability so long as they held a reasonable belief that the potential 
publication was in the public interest. 

Breaches of privacy are also dealt with under civil law and in various professional codes published 
by the Press Complaints Commission, National Union of Journalists and others. These codes apply 
similar tests of 'public interest' to the obtaining and disclosure of personal data. 

In evidence to the DCMS Select Committee in 2009 Information Commissioner Christopher 
Graham said, "Sometimes journalists have to do pretty underhand things to get stories that are 
manifestly in the public interest. The classic example is The Guardian and the "cod" fax that got the 
evidence that put Jonathan Aitken in prison". 15 

A more recent example would be the Daily Telegraph which was not prosecuted for disclosing 
private information about MP's expenses because it was so clearly in the public interest, even if they 
had apparently spent over £100,000 obtaining the data. 
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However, what we know of both from Whittamore's extensive records and his usual methods 
indicates that he, and the journalists he was working for, must have committed widespread offences 
under the Data Protection Act because much of the trade in data was not in the public interest. 
Indeed, in a ruling on Operation Motorman at the Leveson Inquiry, Lord Justice Leveson said, 
"When I saw the identity of some of those who had been targeted and the nature of the information 
sought, it seemed to me clear not only that much information had been obtained in breach of the 
Data Protection Act but also that the potential to deploy the statutory defence was limited in the 
extreme". 16 He also stated, "To say that there was prima facie evidence that Mr Whittamore was 
acting illegally is to assert what was blindingly obvious: he had, after all, been convicted of 
offences". 17 

David Sherborne, the barrister acting on behalf of press intrusion victims, said at the Leveson 
Inquiry, about Operation Motorman in June 2012, "[whether] this is more or less serious than 
hacking is irrelevant because both were the unlawful tricks of a very tawdry trade in people's 
private information". 18 Lord Justice Leveson, himself, in his ruling of 1 1 th June 2012 commented on 
invasions of privacy and "the alleged culture which has permitted such invasions to pervade parts of 
the present media landscape" and added, "I equally understand why it might be thought that 
Operation Motorman provides better evidence of that culture than the interception of mobile 
telephone messages because it undeniably extends beyond one title". 

In his only interview Whittamore put his own view more colourfully, "I suppose you could view it 
as my Oliver Twist to the press's Fagin. Something along those lines. Requests were asked of me by 
people who I knew as being really above reproach. They were huge corporations, I assumed they 
knew what they were asking for." 19 He also admitted, "towards the end it got more and more 
personal", acknowledging that the practice "had got out of hand". Alec Owens, the former ICO 
investigator, who led the raid on Whittamore's house told me that Whittamore said little that day. 
But he did tell Owens that although he would not dispute what he had done himself he would never 
talk about the journalists he dealt with. 

Clearly Lord Justice Leveson, who has access to the Motorman records, believes that there is 
evidence that some newspaper groups broke existing laws and guidelines when they hired private 
detectives to obtain personal data. 

The key question for the Observer is whether there is any evidence that when they used Steve 
Whittamore they were one of those newspapers. 

What price privacy now? (2006y° 

In May 2006 the Information Commissioner published a report entitled What Price Privacy? about 
the unlawful trade in personal data.lt reported that 305 journalists had been identified during 
Operation Motorman as customers of Steve Whittamore. Following FOI requests the ICO decided 
to include detail about who the journalists were employed by and a breakdown of their activity, in 
an special additional report to Parliament 
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On December 13 th 2006 the Information Commissioner published this further report which was 
subtitled "The first six months progress in halting the unlawful trade in confidential personal 
information" and was the first public excavation of the Operation Motorman evidence. Indeed, such 
was the scale and complexity of the personal information trade highlighted in Whittamore's 
notebooks that nearly three years had passed since the original raid on Whittamore's home. 

In the report Richard Thomas, who was the Information Commissioner at the time, recommended 
the implementation of a two year prison sentence for data offences rather than the relatively small 
fines normally imposed. In fact, over nearly the four previous years, only two out of twenty two 
prosecutions had produced fines of more than £5,000. He wrote, "People care about their personal 
privacy and have a right to expect that their personal details are and should remain confidential. 
Who they are, where they run their lives; these are all private matters. Individuals may choose to 
divulge such information to others, but information about them held confidentially by others should 
not be available to anyone prepared to pay the right price". 

The report listed for the first time the publications that had paid Whittamore for private data. Top of 
the list was The Daily Mail with 952 "transactions positively identified" involving 58 journalists, 
followed by the Sunday People with 802 transactions from 50 journalists. The Mail on Sunday was 
listed with 266 transactions from 4 journalists. Other publications using Whittamore included The 
Sunday Times, Express and News of the World. 

Down the list at number nine was the Observer with 103 transactions involving a total of four 
journalists. Given the leading role of its sister paper, the Guardian, in uncovering the phone hacking 
scandal the presence of The Observer in the top ten users of Steve Whittamore's services was bound 
to attract comment. 

The ICO Files 

I have reviewed the Observer material sent to the newspaper by the ICO that was based on the 
original A4 notebooks kept by Whittamore and that the ICO subsequently transferred into spread 
sheet form. I have also seen examples from those original handwritten notebooks, and I have 
checked the invoices and payment slips involving Whittamore that are held in the Observer system. 
In addition, I have noted the leaks of the Operation Motorman material that have been reported in 
the press or on the internet. Whittamore's notebooks are more comprehensive than the invoices the 
ICO recovered from his house. The invoices cover a slightly different timeframe, and offer a much 
less definitive picture of how Whittamore conducted his business. 

Overall, the picture is incomplete and confusing like a jigsaw with many pieces missing or broken. 
Even the source material is hard to decipher, as well as being undated. As Christopher Graham, the 
current Information Commissioner, wrote in his second witness statement to the Leveson Inquiry 
about Whittamore's work books,"like a reporters notebooks the ledgers no doubt made perfect sense 
to the man who made the entries, but the entries in the ledger are often ambiguous" 21 . Whittamore 
himself, according to one of the investigators, 'played his cards close to his chest and told us little or 
nothing'. Whittamore's hand written ledgers might have made sense to him or his wife, but to an 
outsider they are scrappy and unclear. The Commissioner himself called them "deeply obscure". In 
addition, Whittamore's invoices to the Observer give no details of the individual transactions 
merely requesting payment for "Confidential Enquiries" The Observer records authorising payment 
to Whittamore are just as unrevealing. 

In What Price Privacy Now? the ICO noted 3,757 "transactions positively identified" between 
Whittamore and a string of newspapers and magazines. However, in his second witness statement to 
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the Leveson Inquiry 22 , Richard Thomas CBE, the former Information Commissioner, confirmed that 
there were in fact 13,433 transactions from over 30 publications discovered in the source material. 
The original, much lower figure, presumably had been confined to cases where there was prima 
facie evidence of the law being broken. 

Of the revised total of 13,433, 5,025 were identified, "as transactions that were (of a type) actively 
investigated in the Motorman enquiry and. . . positively known to constitute a breach of the DPA 
1998". He went on to write that "a further 6330 represent transactions that are thought to have been 
information obtained from telephone service providers and are likely breaches of the DPA". That 
leaves nearly 2000 transactions that are just not clear enough for the ICO to make a judgement one 
way or another. 

Alec Owens, the original Senior ICO investigator who led the raid on Whittamore's office, has 
publicly criticised even the revised ICO 'official' numbers claiming that the real number of enquiries 
by Whittamore was closer to 17, 500. 23 An analysis by Ed Campbell at ITV News 24 concurred, and 
suggested that the ICO numbers should all be revised upwards with, for example, the Daily Mail on 
1,728 requests and the Observer at just over 201, rather than the 103 outlined by the ICO. These 
figures, if correct, would mean that the Daily Mail used Steve Whittamore more than once a day on 
average. The responses of several newspapers to this material are on the ITV News website. 

ITV News say that they calculated these numbers cautiouslynot including any transaction with 
Whittamore that was not clear and those that could not be linked to an individual newspaper. They 
then asked the independent organisation Full Fact to audit their work. Like everyone else, Full Fact 
recognised that the data was "messy, with misspellings, incomplete fields and other inconsistencies 
hampering the analysis". 25 So they agreed that ITV News were right to make "conservative 
assumptions" and confirmed their interpretation before ITV screened their report. Full Fact 
concluded that the ITV News analysis was, "The best that can be hoped for given the quality of the 
data". 

The ICO say the difference between their figures and ITV's is accounted for by their decision to 
group the requests. So, for example, is a request for details on four people living at one address, 
four requests, or one? 

Alec Owens, thinks this is an implausible answer and believes that the ICO were just too hurried 
and got their numbers wrong, probably as a response to the arrest of Glen Mulcaire in August 2006, 
a few months before the ICO published their report. My own interpretation certainly puts the 
number of requests by the Observer at significantly over the original ICO figure of 103 and much 
closer to the figure calculated by Alec Owens and ITV News. 

In any event, everyone is working from the same ICO spread sheet; they are just interpreting the 
data differently. Whatever the exact figure is, the number of requests by journalists to Whittamore 
was very large indeed. Robert Jay Q.C. commenting at the Leveson Inquiry on the discrepancy 
between the two numbers said, "...it doesn't matter anyway because we have frankly a hell of a lot 
of requests". 26 Even more important than the precise number of requests is what exactly those 
requests were for, and whether any laws or codes were broken as a result. 

Understanding the Notebooks 
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In Whittamore's handwritten records each request was noted. The names of the newspapers, the 
journalist, the Whittamore contact undertaking the job, the target and the result were all outlined, 
although sometimes information about the target was sketchy or negligible. There was almost no 
information about exactly how the data was obtained. Against each request was a shorthand code 
which included:- 

- Area = Search of an Area for an individual or an address. 

- OCC = Occupancy check. A search for who is living at an address. 

- CCJ = County Court Judgement. 

- Dir = Details of company directorships. 

All the information in these categories were readily available on the public record and, such, the 
search for these was virtually certain to be legal. 

On the other hand, some information that was requested was not publicly available and in all 
likelihood, was unlawfully obtained unless there was a public interest defence. These include:- 

CRO = Criminal record 

- Veh Reg = Vehicle number 

- FxF = BT Friends and Family 

- Conv/Mob Conv = Converting phone no to the name and address. 

As the ICO told me, these are the only areas where obtaining data via a private investigator is a data 
protection breach "beyond reasonable doubt". 

On the Observer spread sheet from the ICO, three other investigators are named, apart from 
Whittamore himself - Taff Jones, Christopher Dewse (spelt Dewes on the spread sheets) and John 
Gunning. Christopher Dewse was one of those charged under Operation Reproof but, as we know, 
that case collapsed in court. At the Leveson Inquiry Taff Jones was described by Alec Owens, 27 the 
former senior investigator at the ICO, as "a biker and an ex-soldier". To obtain ex-directory 
numbers he would pretend to be a telephone engineer using a special Employer Identification 
Number (EIN) or password to 'blag' the information. Alec Owens told me that Whittamore would 
meet Jones every six weeks or so with a bundle of cash. At the Leveson Inquiry Owens suggested 
that for an XD phone job the newspaper would be charged £75, with Taff Jones taking a cut from 
Whittamore, of £40. 28 

Unlike many of the other newspapers and magazines used by Whittamore there are no recorded 
requests from the Observer for criminal records (CRO), vehicle registration details (Veh Reg) or BT 
Friends and Family (FxF) , all of which are clear breaches of the DPA 1988 if they were not in the 
public interest. The requests from the Observer were much narrower. They were sometimes for area 
(Area) or occupancy (OCC) searches but primarily for ex-directory telephone numbers (XD). 

David Clancy, a senior investigator from the Information Commissioner's Office, considered that 
obtaining XD numbers was a 'grey' area when he told the House of Commons, Culture, Media and 
Sport Committee, "the offence relates to knowingly or recklessly obtaining personal information. . . 
if it was an ex-directory phone number, some of these numbers could have been obtained by ringing 
round friends or other people that they may know and, therefore an ex-directory number may have 
been obtained legitimately". 29 
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As the ICO recognize, some ex-directory phone numbers are also recorded in business databases. 
Whittamore, or the agents he used, may also have used these. Indeed, one agent, Christopher 
Dewse, is believed to have had access to some insurance records. But nonetheless from what we 
know of the modus operandi of Whittamore and his agents a number of phone numbers that were 
ex-directory were likely to have been obtained illicitly either by contacts inside British Telecom or 
another phone provider or by 'blagging', ie using subterfuge to obtain private information. 

Christopher Graham, the current Information Commissioner said in his Leveson evidence, 30 "Phone 
numbers that are not available via directory enquiry services or IMB's (Identity Management 
Businesses) will, ipso facto, be personal information that citizens prefer to keep private". 
One guideline to both the difficulty and the danger of any data request was Whittamore's price list 
which varied with the service requested. Steve Whittamore would charge £500 for a criminal 
records check, a price that no doubt reflected the illegality, as well as the risk involved. Vehicle 
registration data cost £150-£200. At the bottom end of his tariff were ex-directory phone numbers at 
between £65 and £75 a time. 31 There was some flexibility in the tariff so information about Kate 
Middleton, for example, was at a premium price. There is no evidence from any of the vast amount 
of material gathered by the ICO or by the police that Whittamore was ever involved in phone 
hacking. Alec Owens told the Leveson Inquiry, "he wasn't hacking, he was definitely not into 
hacking, we found no evidence of that". 32 Of course, as Mr Owens pointed out, it is possible that 
the numbers provided by Whittamore were subsequently hacked by journalists or other private 
detectives without Whittamore's knowledge. 

How it worked 

I have talked at length, to the key journalists, to the news desk staff named by Whittamore in his 
notebooks and also to senior managers on the paper at the time. Given that we are talking about 
1993-2003, a period that began thirteen years ago, recollections were inevitably patchy. 

In terms of context, the Data Protection Act 1998 coincided with rapid change at the Observer. 
There was a significant turnover on the news desk and in senior management including the 
departure of Will Hutton who was replaced by Roger Alton as Editor in 1998. That same year there 
were new appointments at Deputy Editor and Home News Editor level. 

There was, one journalist felt, also a hardening, a toughening up, of journalism on the paper over 
the next two years,with some staff coming in from tabloid backgrounds and trying to make the 
paper more competitive by shifting the Observer away from the more gentle liberal journalism of 
before. 

Steve Whittamore may also have been an import from a tabloid paper. When the ICO raided his 
house the notebooks they found only went back to 1999 but from his invoices it is clear that he was 
active before then. His records from 1999-2003 gave the ICO a snapshot of Whittamore's business 
but not the complete picture. In 1999, he was certainly widely used across the industry. Initially, 
Whittamore's tracing business was a news desk service provided to reporters, particularly 
investigative journalists, and all contact was routed through the news desk coordinator. Later some 
of the more regular users on the Observer were authorised by the news desk to open up direct 
contact with Whittamore because it saved time and was more effective. 
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Pressure on Observer journalists to deliver the investigative, political and business scoops on 
Sundays was high. These broadsheet investigations were part of the ethos of the paper, what it was 
there to do. As a weekly newspaper, if a story was not stood up for Sunday there was a significant 
risk that a daily competitor would claim it for their own before the Observer was next published. 
They were, as Roger Alton put it to me, writing, "difficult, complicated and important stories". 

In some ways Whittamore was a news desk service like booking a cab or pulling out cuttings from 
the archive or using a local stringer. Having a tracing agent like Whittamore on hand was part of the 
toolbox used by news journalists,it was part of the investigator's tradecraft. 

Once services had been provided, Whittamore simply invoiced the news desk for "Confidential 
Enquiries". Details of what those services entailed, who the target was and who ordered the work 
did not appear on the invoice, nor did any information appear on the payment slip, although no 
doubt all payments were approved by senior managers before the accounts department would pay. 
These payments were authorised routinely. They were for relatively small sums of money and in the 
minds of those signing off Whittamore's invoices were unremarkable. A typical Observer payment 
slip would have Whittamore's JJ Services as one of a list of eight or ten payees, mainly stringers. 

In the Observer newsroom there was a limited awareness of the details or implications of the Data 
Protection Act 1998, which came into force in early 2000. At the time there was no training for 
journalists on the Observer about data protection. However there was an editorial code issued by the 
Press Complaints Commission (PCC). The Guardian also drew up a set of journalistic guidelines 
but this was not adopted by the Observer. Although privacy was mentioned in both these codes none 
of this advice for journalists specifically covered the use of private detectives. Most journalists at 
the time knew that obtaining criminal records or bank details was wrong but their knowledge of 
data legislation did not stretch much beyond that. It wasn't until August 2007, nine months after the 
publication of "What Price Privacy Now", that the PCC code was revised to add 'misrepresentation 
or subterfuge, including by agents or intermedaries'. 33 

However, the investigative journalists on the Observer were aware that Whittamore probably 
operated in a grey area so they didn't ask how the information was obtained or, as one senior figure 
put it, "we never looked under the bonnet". Another journalist said, "If we had a fault it was that 
we didn't do due diligence on him". Indeed most journalists did not know Whittamore's surname. 
They just knew that the news desk had someone who could help them find out information quickly. 
Some knew he was called Steve. A couple called him Fingers. It was a very informal arrangement. 

Whittamore was also quick. One journalist said that he sometimes came back with a phone number 
in twenty minutes that you might have found another way, but it would have taken hours or days. 
Sometimes Whittamore was unable to help. Some journalists only used Whittamore as a last resort 
because of the cost. One journalist recalls allegations about a senior politician being discussed with 
the paper's lawyer and news editor and the decision being made not to use a private investigator to 
find corroboration but to "find out another way". Overall, as one journalist put it, "We shouldn't 
forget that Whittamore provided a useful service. He helped us with some big stories... we needed all 
the help we could get because we were up against some big names with expensive lawyers". 
Another called the Observer "a public interest newspaper". 

In this journalistic culture, not only was there no training but also only limited oversight from senior 
management. Investigative journalists, some of whom were freelance, just got on with their stories 
in their own way, with their own contacts, because that is what they were expected to do. In an 
informal system like this there was no proper process, no editorial code, no senior management sign 
off except for some occasions when a senior manager told a journalist to use Whittamore. That, of 
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course, is not what it is like now; but it was the culture throughout Fleet Street in 1999 in the days 
when the internet was still in its infancy and information was more elusive. 

More than that, the Observer had a fine track record of investigations, a key hallmark of the paper. 
There was no plan, or desire, to invade privacy but if they did, in the course of a story, then the 
public interest, they felt certain, was on their side. They saw themselves as the good guys trying to 
expose the wicked deeds of the baddies. Roger Alton told me, "We were uncovering truth, holding 
people to account, making sure that justice was done". 

As the Observer put it more formally in a 2006 leader, "occasionally all newspapers that turn over 
stories will need to do exceptional things and need that freedom if they are to be effective 
watchdogs. But such investigations can't be generalised trawls for titbits..." 34 

Public Interest 

If a critical defence for journalists accessing potentially unlawful private information from Steve 
Whittamore or other private investigators, is whether the disclosure of that information would be in 
the public interest, what does that mean? 

Clearly that is not the same as what interests the public. The majority of requests to Whittamore 
from other newspapers and magazines appear to be exactly that - celebrity gossip that would 
interest the public. 

The current definition of public interest that is most widely accepted is enshrined in the Press 
Complaints Commission code to which The Observer and The Guardian both subscribe. It defines 
public interest as, "including but not confined to detecting and exposing crime, or senior 
impropriety; protecting public health and safety and preventing the public from being misled by an 
action or statement of an individual or organisation." The current National Union of Journalists' 
Code of Conduct says material should be obtained "by honest, straightforward and open means, 
with the exception of investigations that are both overwhelmingly in the public interest and which 
involve evidence that cannot be obtained by straightforward means". 35 The PCC code also adds, 
"There is public interest in freedom of expression itself. 

Keir Starmer Q.C, the Director of Public Prosecutions, explored the value of freedom of expression 
further in April 2012, when he issued interim guidance for prosecutors in cases affecting the media. 
He said that, "Freedom of Expression and the public right to know about important matters of 
public debate are an essential foundation of our society but there are limits for those crossing the 
line into criminality". 36 

Under the guidelines the DPP emphasised that prosecutors needed "to access whether the public 
interest served by the conduct in question outweighs the overall criminality before commencing a 
prosecution. If so, a prosecution is less likely". 

The Information Commissioner put it in his own way, "freedom of speech is not freedom to break 
the law by bribery or deception where there is no public interest justification. It is difficult to 
imagine a prosecution - let alone a conviction-of any journalist able to show that he or she was 
pursuing a story to prevent or detect crime, to expose public impropriety, or was otherwise acting in 
the public interest". 



Observer: 13 th August 2006 

PCC Code: 10 th December 2007 

Director of Public Prosecutions April 18 th 2012 
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The details 



I have looked in detail at all the evidence that the Information Commissioner has provided to the 
Observer including their spread sheet of individual cases taken from Whittamore's A4 notebooks 
and his invoices to the newspaper. I have also met with a senior representative of the ICO and 
discussed their findings, and talked to the key journalists. 

I have examined every single case on the spread sheet as best I can. The names break down into a 
number of groups :- 

1 . Names that can be directly connected to articles in the Observer. 

2. Names that appear in articles in other newspapers but not in the Observer which, by cross 
referring, indicates what the Observer enquiry was probably about. 

3. Names that were connected to investigations that did not turn into articles but where the 
subject of the investigation can be clearly established. 

4. Just a simple surname or Christian name and surname appears, usually with geographical 
location. No articles appeared in the paper or any other paper connected to the single name 
and it is impossible to trace what the enquiry was about. Although, of course, quite often 
leads in investigations fizzle out. 

Overwhelmingly, the Observer wanted a straight forward service from Whittamore, the finding of 
an address and/or phone number and around 90% of their payments to Whittamore involved XD 
numbers and/or occupancy searches. They never asked for criminal records, friends and family 
numbers, or car registration details. The remaining 10% of payments to Whittamore were mobile or 
landline conversions, including one 'blag'. 

In a significant number of instances these requests were to ensure that the Observer fulfilled a basic 
duty of journalistic fairness by asking a participant to comment on a story they were about to 
publish. One journalist thought that around half of his requests to Whittamore involved the need to 
put allegations to someone before the paper went to press. In his evidence to the Culture, Media and 
Sport Select Committee in September 2009 Christopher Graham underlined that point, "the process 
of approaching subjects for checking out a story is absolutely essential and I would be very 
concerned if newspapers weren't trying to contact people. It is very often a critical element of the 
Reynolds defence of responsible journalism and a key aspect of the relevant professional codes". 37 
In a number of cases, although a data breach may have been involved, the information could also 
have been found by Whittamore or the journalist legitimately. Some of the telephone numbers 
provided by Whittamore were of activists or campaigners who were keen to speak to the press and 
whose phone numbers could just as easily have been found without breaking any code or law. 

Apart from the investigative journalists who used Whittamore his other major client on the 
Observer was the news desk. If a story broke on a Friday or Saturday and further investigation was 
needed or a phone number was essential for a right to reply, then Steve Whittamore provided a 
helpful short cut when time was tight. 

There was one example that was mentioned to me by Observer writers on more than one occasion. 
In 2005 two teenage girls were killed on a level crossing in Essex on a Saturday. Given the timing, 
and in the interests of speed, the news desk asked Steve Whittamore to find relevant phone 
numbers. Given that Network Rail were subsequently fined £1,000,000 for safety failings at the 
crossing the story was in the public interest. 



DCMS Select Committee:2 nd December 2009 
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My Terms of Reference indicate that, "where obtaining the information must have involved a 
breach of the relevant codes or laws I should try to determine "whether in such cases there is 
evidence that there were public interest reasons for such breaches". 

Of those names detailed on the ICO spreadsheet, in just under 20% of the cases there is just 
insufficient evidence on the spreadsheet, in Whittamore's notebooks, in the Observer or in any other 
newspaper, to know either who the person was or what the story was about and therefore to judge 
the question of public interest. 

In the 80% of names where details are sufficiently clear and having correlated the Whittamore 
notebooks with articles in the Observer and other newspapers I am certain that Observer journalists 
who used Whittamore for these stories, would have a public interest defence. Stories about slum 
landlords, terrorism, miscarriages of justice, political misbehaviour, illegal arms smuggling and 
police harassment, for example,were all published after Whittamore had obtained addresses and ex- 
directory phone numbers. 

In one of his rulings on Operation Motorman Lord Justice Leveson made it clear that he would not 
reveal names because he had "no wish to breach the privacy of those whose personal information 
had been sought". 38 Following that guidance, I cannot go into the details of these stories without 
risking infringing the right to privacy, of both individual journalists and the people they write about. 
But here is an emblematic but anonymised example. In 2002 three articles appeared in the paper 
about a racketeering landlord who was financially exploiting vulnerable people. A complex web of 
companies was involved as were a number of different individuals, some of whom used several a 
variety of aliases. Some data could have been found legitimately from Companies House, and some 
from local campaigners, but the scale of the task , as well as the need to get a comment from the 
landlord meant Whittamore was the simplest and quickest route to the necessary information. 
Whittamore's ledgers reveal at least thirteen separate enquiries for this story of which five were ex- 
directory phone numbers and the rest occupancy or company director checks. A second example is 
another investigation, this time into arms trading, which involved six separate occupancy and ex- 
directory number requests. 

The majority of requests to Whittamore bear the same hallmarks as both these stories. However, 
there are some anomalies that emerged from the Whittamore data. On one occasion, according to 
ITV News, 39 £90 was spent on a 'blag'. Having looked at this carefully myself, this involved a high 
profile figure and it was certainly in the public interest. There were also four payments for mobile 
conversions to names and addresses at £75 each.Two of these cases were certainly in the public 
interest and there is insufficient data to be clear about the others. 

There is also one XD request during this period made from outside the news desk or investigations 
team. It does not correlate with any article in the newspaper nor does the journalist have any 
recollection or notes about what the request involved. The most regular Observer user of 
Whittamore,according to both ITV News and my own figures, made 62 requests over a three year 
period involving 24 names at a total cost of £2375. 

Overall, as I wrote earlier, there are a small number of names in the notebooks where it is 
impossible to know what the potential story was about. That uncertainty aside, where there is 
sufficient information, I could not find a single story where Whittamore provided private data that 
could not be defended in the public interest. 



38 Leveson Inquiry: 10 th July 2012 
39 ITVNews28/29 ,h March 2012 
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I should add that recently, Alex Salmond, First Minister of Scotland, accused the Observer of 
having access to his bank records eleven years ago. 40 Whether this is true, or not, for the avoidance 
of doubt, I should say there is no reference to Mr. Salmond or to this story in Steve Whittamore's 
notebooks. 



The Observer Response 

In December 2006, two weeks after the publication of What Price Privacy Now?, Observer lawyers 
advised the News Editor about the Data Protection Act and legal issues relating to Operation 
Motorman. 41 In March 2007 refresher training courses in the DPA and related issues began for 
Observer journalists. 

The following month Roger Alton, then Editor of the Observer wrote to the Press Complaints 
Commission about the new system in place, "I have reviewed our practices and made it clear to 
staff that no enquiries should be made through outside agencies unless there is compelling public 
interest to do so. The use of such agencies should be regarded as exceptional, and Observer 
journalists should seek advice from a senior editor before obtaining information in this way". 42 
The letter also underlined a commitment to training and to work within the PCC code. 

There is no evidence in the files that the Observer used any other private investigators apart from 
Whittamore and his associates. However, it is clear from other court cases and investigations that 
although Whittamore appears to have been the market leader in trading personal information, he 
was not the only private investigator working with sections of the press. 

The Observer's own perspective on breaking editorial codes was clear in a leader published in 
August 2006, four months before the publication of What price privacy now?, "occasionally all 
newspapers that turn over stones will need to do exceptional things and need that freedom if they 
are to be effective watchdogs. But such investigations can't be generalised trawls for titbits. . . 
condone that and the kind of seamy wheezes alleged here will poison the well for all journalism". 43 

In his written evidence to the Leveson Inquiry in October 2012 John Mulholland, Editor of the 
Observer since 2008, stated, "No journalist has used a private investigator while I have been editor 
of the Observer, to the best of my knowledge". 44 At the same Inquiry in September 201 1, Alan 
Rusbridger, Editor-in-Chief for Guardian News and Media, said "since the publication of What 
Price Privacy Now? in December 2006 I do not believe that the Guardian or the Observer 
newspaper has used or paid private investigators to source stories or information from the police 
public officials, mobile phone companies or others with access to the same". He went on, "There 
have been occasions when staff joining from other titles have asked whether they can use a private 
investigator. The answer has been 'no' except to access information in the public domain". 45 

After 2006 

Following a complaint from an MP in 2010,and in response to readers' queries, the Observer's 
Readers' Editor and a lawyer visited the ICO in Cheshire to try to obtain the Operation Motorman 
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data. They attempted to analyse the ICO Motorman material and interviewed journalists and news 
editors. Where there was sufficient information they also connected the evidence they were given 
by the ICO, to individual stories in the Observer and elsewhere. In February 2011 the Observer's 
Readers' Editor wrote a considered column about the Observer's use of Steve Whittamore. 46 

Whittamore's notebooks, and therefore my Terms of Reference only cover 1999-2003. However, his 
services were certainly used both before and after these dates until the publication of What Price 
Privacy Now? in late 2006 brought the use of Whittamore by the Observer to a swift halt. 

Although I can make a solid assessment of the material during 1999-2003 the ICO hold no 
Whittamore notebooks outside this period. Alec Owens told me that his ICO team searched 
Whittamore's tiny back office for more than six hours and that in all probability earlier notebooks 
had been thrown away or moved elsewhere as such a thorough search by the ICO in such a small 
office would have found them if they existed. Invoices from Whittamore and payments back from 
the Observer contain so little information that they are of negligible value too. Before 1999 there is 
no evidence of any payment because the Observer no longer holds records from this period. But I 
am told that for a substantial period before 1999 the newspaper stopped using Whittamore 
completely because his discretion was no longer trusted, but they started using him again in 1998 or 
1999. 

After 2003, when the ICO records stop, there is some evidence of continued usage of Whittamore. 
On the Observer system, Whittamore's JJ Services is shown to have received several payments, 
recorded as Confidential Enquiries or Confidential Searches, or just Searches. In some of these 
cases the individual journalist is named but there is no reference to the story he or she asked 
Whittamore to assist with. 

The pattern of usage during these years looks broadly similar to 1993-2003 with investigative 
journalists to the forefront although sometimes the news desk authorised or recommended news 
reporters to use Whittamore if there was no alternative. The news desk journalists I have spoken to 
assert that the news desk would not have recommended they use Whittamore if it was not in the 
public interest. 

Nonetheless, there is such limited information available for these years that no one can be hundred 
per cent certain. On three or four occasions other journalists outside news or investigations used 
Whittamore and these make up about five per cent of the payments to his company. It may be that 
an ex-directory number was needed in the public interest or for a right to reply on these tiny number 
of occasions. Equally, it could possibly be a hard pressed journalist using Whittamore for an XD 
number without a clear public interest purpose. There is just no way of knowing without 
Whittamore's own records. 

Conclusion 

1 . From the evidence available for the years 1999-2003, which are those covered in my Terms 
of Reference, because they are the years included Whittamore's extant notebooks, I 
conclude that there is absolutely no evidence that Observer journalists "breached editorial 
codes or civil/criminal law". As I noted earlier, about twenty per cent of the data relating to 
the Observer in Whittamore's ledgers is, to use the ICO phrase, "deeply obscure" because 
there is absolutely no way of knowing the subject of these stories. As Full Fact put it, "There 
are no perfect analyses of such data". But given the pattern of the other eighty per cent, and 
the type of journalists involved, it is more than likely that these too were requests in the 
public interest. 

46 Observer: 13 th February 201 1 
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Observer journalists obtained personal data from a private investigator but, to use the words 
of the Data Protection Act 1998 Section 55 (1), they did not do so "knowingly or 
recklessly". Steve Whittamore's services were used largely in the pursuit of 
investigative journalism and what evidence we have indicates that the use of Mr Whittamore 
was overwhelmingly in support of public interest stories. Often Whittamore helped 
journalists contact those being written about as part of a Reynolds defence for responsible 
journalism. To use the recent test outlined by Keir Starmer Q.C., Director of Public 
Prosecutions, the public interest in these data protection breaches "outweighed criminality". 
Others who have examined the data also found nothing obviously surprising about the 
names the Observer requested information about. As Ed Campbell of ITV News put it, "I 
never encountered a name I thought odd". Overall, I can find no evidence of egregious use 
of Steve Whittamore by the Observer. 

2. In 1999 the new Data Protection Act was in its infancy and did not become active until 
March 2000. Knowledge of the legislation amongst journalists was patchy. "It just wasn't a 
priority", said one. 

It is clear that most journalists thought that Whittamore was a useful short-cut to a phone 
number and assumed,or perhaps hoped, that he used legitimate means. In any event, no one 
asked questions in case they didn't like the answer. Anyway, they had the public interest on 
their side, they thought. 

What is certain is that there was little or no oversight from Observer senior management at 
the time - no training, no guidance on the new data legislation and limited questions. Senior 
management also now acknowledge that, as a relatively junior member of staff was the main 
conduit to Whittamore, the relationship lacked scrutiny at a senior level. This was probably 
not dissimilar to other newspapers in 1999-2003, after all many of them used Whittamore 
and other private investigators more frequently than the Observer. As Paul Dacre, Editor of 
the Daily Mail,put it at the Leveson Inquiry, "There was a very hazy understanding of how 
the DPA worked and this was seen as a quick way of obtaining phone numbers and 
addresses to corroborate stories". But it is regrettable that corporate governance at the time 
was not good enough to make Observer journalists, or writers on other newspapers who 
used Whittamore, more aware of the potential pitfalls of Data Protection legislation. 

After What Price Privacy Now? was published in December 2006 the Observer responded 
by quickly introducing new training and a new code which means that using a private 
investigator would not happen now without a full sign-off at senior editorial level. 
The 2005 case against Steve Whittamore and others in which they pleaded guilty to data 
offences did not receive widespread publicity but it did attract some press attention. 
Both the Guardian online 47 and the UK Press Gazette 48 carried reports. As hardly anyone on 
The Observer knew his full name and the 2005 case did not involve Whittamore's 
relationship with the Observer, it was perhaps hard to connect a few limited paragraphs 
online about the Whittamore court case to the private investigator in Hampshire the paper 
had been using. But, nonetheless, it is surprising that the case in April 2005, over a year 
before the paper stopped using Whittamore, did not ring an alarm bell, even a modest one, 
with at least one person on the Observer about the more general risks of using private 
investigators to obtain private data. 



47 Guardian:23 rd July,15/16 ,h April 2005 

48 UK Press Gazette: 15* April 2005 
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3. It is important to remember that the Observer was a limited user of Whittamore's services 
and therefore to put their involvement into perspective. The ICO 49 recorded 13,343 
transactions between the press and Whittamore of which 103 were from the Observer at a 
total cost of just over £13,000. The Mail on Sunday and Daily Mail between them used 
Whittamore 1218 times between them, according to the ICO, spending over £200,000. The 
figures from Alec Owens and ITV News are even higher. It is also fair to point out that the 
more flagrant breaches of the Data Protection Legislation, such as the trade in criminal 
records or vehicle licence data, did not happen on the Observer. Their requests were 
confined almost entirely to obtaining extra directory telephone numbers. There was not, as 
one writer claims, a "blagging culture permeating the Observer". 50 

In contrast, the Mirror requested criminal records nineteen times at £500 each, totalling 
£9,500. The Mail on Sunday asked Whittamore for BT Friends and Family information 
sixty-five times at a total cost of £336 each, totalling £21,000. Some of these requests, of 
course, may have been in the public interest, a point made forcefully by Associated 
Newspapers at the Leveson Inquiry. 

4. In the end we must return to Roger Alton's 2006 quote in which he acknowledged the use of 
a private detective and added, "While there have been strong public interest defences for 
most of these cases, it is possible that some of the enquiries do not fit those criteria". 

Given the limited information available that is a fair answer. But it would be harsh indeed to 
condemn the Observer for using Whittamore illegally or inappropriately when there is 
absolutely no evidence they did and just because, in some cases, the material is so 'deeply 
obscure' that no one can ever be certain. 

From the material I have reviewed, and new evidence I have uncovered, the clear 

picture is that the Observer overwhelmingly used Steve Whittamore's services in their efforts 

to expose public impropriety or crime. To conclude otherwise would not be just or fair. 



John Willis 
Ombudsman 
November 2012 



• This document was amended on 28 November 2012 to remove a reference to The Drum blog. 



49 What Price Privacy Now?(ICO)13 ,h December 2006 

50 The Drum:4 th April 2012 
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